Privacy Policy

Only what we need: device MAC/IP to bind your pass, optional Paystack email for receipt, and venue transaction metadata (plan, price, duration, voucher hash). No browsing history, files, or app data. Card/bank numbers never touch our servers.

MAC/IP verifies you have an active pass (passwordless HotSpot). Email triggers Paystack receipts. Venue aggregates (revenue, ARPU, active sessions) are computed server-side from Payment/Order — not from personal profiles.

Sessions and audit logs roll after expiry. Fulfilled payments and voucher hashes are kept 90 days for reconciliation, then anonymized. Unredeemed vouchers expire in 7 days. Request deletion via venue or talk2icedmist@gmail.com.

No sale or rental to advertisers. We share only with processors needed to operate: Paystack (payments), Supabase Postgres (encrypted at rest), and the venue's MikroTik router (local HotSpot user, no cloud browsing logs).

All hops are HTTPS/TLS 1.2+ with HMAC-SHA512 webhook verification, server-locked pricing, atomic idempotent fulfilment, and voucher SHA-256 hashing. Router API uses least-privilege credentials and Walled Garden for Paystack/Supabase only.

Web portal uses only essential cookies for auth and MAC prefill (?mac=). No third-party ad trackers. Mobile app uses SharedPreferences for onboarding flag and Supabase session only.

Access, correction, export, or deletion: email talk2icedmist@gmail.com with your venue and MAC. We respond within 30 days, subject to legal retention (e.g., payment audit).

Not directed to children under 13. Venues must obtain guardian consent where required by local law before issuing passes to minors.

Data is hosted in EU-Central (Supabase) and processed in Nigeria (venues). Paystack transfers are NGN-only. By using WavePass, you consent to this processing.

Controller: Nexa Digital Nexus Point (techwithnexa.com) • DPO: talk2icedmist@gmail.com • Supabase project vvoenmdzavyzlisykhks. Updates posted here 30 days before effective date.